Read the docs
TI-2009-00187 Aliases CVE-2009-0200GHSA-vqgr-rw7q-xxwm

Integer underflow in OpenOffice.org (OOo) before 3.1.1 and StarOffice/StarSuite 7, 8, and…

Priority MEDIUM 50CWE-189Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Code execution
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-189 and the CVSS impact.

Summary

Integer underflow in OpenOffice.org (OOo) before 3.1.1 and StarOffice/StarSuite 7, 8, and 9 might allow remote attackers to execute arbitrary code via crafted records in the document table of a Word document, leading to a heap-based buffer overflow.

Why it matters now

EPSS 0.06722 93rd percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 59

CPEVersionsRoleVendor
cpe:2.3:a:openoffice:openoffice.org:*:*:*:*:*:*:*:*up to 3.1VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:1.0-ru:*:*:*:*:*:*:*1.0-ruVulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:1.0.0:*:*:*:*:*:*:*1.0.0VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:1.0.1:*:*:*:*:*:*:*1.0.1VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:1.0.2:*:*:*:*:*:*:*1.0.2VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:1.0.3.1:*:*:*:*:*:*:*1.0.3.1VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:1.1:*:*:*:*:*:*:*1.1VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:1.1:beta:*:*:*:*:*:*1.1 betaVulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:1.1:beta2:*:*:*:*:*:*1.1 beta2VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:1.1:rc1:*:*:*:*:*:*1.1 rc1VulnerableOpenoffice
  • cpe:2.3:a:openoffice:openoffice.org:*:*:*:*:*:*:*:* Versions up to 3.1 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:1.0-ru:*:*:*:*:*:*:* Versions 1.0-ru Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:1.0.2:*:*:*:*:*:*:* Versions 1.0.2 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:1.0.3.1:*:*:*:*:*:*:* Versions 1.0.3.1 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:1.1:beta:*:*:*:*:*:* Versions 1.1 beta Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:1.1:beta2:*:*:*:*:*:* Versions 1.1 beta2 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:1.1:rc1:*:*:*:*:*:* Versions 1.1 rc1 Vulnerable ·Openoffice
Show 49 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:openoffice:openoffice.org:1.1:rc3:*:*:*:*:*:*1.1 rc3VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:1.1.1:*:*:*:*:*:*:*1.1.1VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:1.1.2:*:*:*:*:*:*:*1.1.2VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:1.1.3:*:*:*:*:*:*:*1.1.3VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:1.1.4:*:*:*:*:*:*:*1.1.4VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:1.1.5:*:*:*:*:*:*:*1.1.5VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:1.9.84:*:*:*:*:*:*:*1.9.84VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:1.9.87:*:*:*:*:*:*:*1.9.87VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:1.9.91:*:*:*:*:*:*:*1.9.91VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:1.9.93:*:*:*:*:*:*:*1.9.93VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:1.9.95:*:*:*:*:*:*:*1.9.95VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:1.9.100:*:*:*:*:*:*:*1.9.100VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:1.9.104:*:*:*:*:*:*:*1.9.104VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:1.9.113:*:*:*:*:*:*:*1.9.113VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:1.9.118:*:*:*:*:*:*:*1.9.118VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:1.9.122:*:*:*:*:*:*:*1.9.122VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:1.9.130:*:*:*:*:*:*:*1.9.130VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:1.9.156:*:*:*:*:*:*:*1.9.156VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:1.9.680:*:*:*:*:*:*:*1.9.680VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:2.0:*:*:*:*:*:*:*2.0VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:2.0:beta2:*:*:*:*:*:*2.0 beta2VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:2.0.1:*:*:*:*:*:*:*2.0.1VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:2.0.2:*:*:*:*:*:*:*2.0.2VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:2.0.2:rc1:*:*:*:*:*:*2.0.2 rc1VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:2.0.2:rc2:*:*:*:*:*:*2.0.2 rc2VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:2.0.3:*:*:*:*:*:*:*2.0.3VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:2.0.4:*:*:*:*:*:*:*2.0.4VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:2.1:*:*:*:*:*:*:*2.1VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:2.1.152:*:*:*:*:*:*:*2.1.152VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:2.1.154:*:*:*:*:*:*:*2.1.154VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:2.2:*:*:*:*:*:*:*2.2VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:2.2.1:*:*:*:*:*:*:*2.2.1VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:2.3:*:*:*:*:*:*:*2.3VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:2.3.1:*:*:*:*:*:*:*2.3.1VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:2.4:*:*:*:*:*:*:*2.4VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:2.4.1:*:*:*:*:*:*:*2.4.1VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:2.4.1:*:64-bit:*:*:*:*:*2.4.1VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:3.01:*:*:*:*:*:*:*3.01VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:605b:*:*:*:*:*:*:*605bVulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:609:*:*:*:*:*:*:*609VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:614:*:*:*:*:*:*:*614VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:619:*:*:*:*:*:*:*619VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:627:*:*:*:*:*:*:*627VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:633:*:*:*:*:*:*:*633VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:638:*:*:*:*:*:*:*638VulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:638c:*:*:*:*:*:*:*638cVulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:641b:*:*:*:*:*:*:*641bVulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:641d:*:*:*:*:*:*:*641dVulnerableOpenoffice
cpe:2.3:a:openoffice:openoffice.org:643:*:*:*:*:*:*:*643VulnerableOpenoffice
  • cpe:2.3:a:openoffice:openoffice.org:1.1:rc3:*:*:*:*:*:* Versions 1.1 rc3 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:1.1.1:*:*:*:*:*:*:* Versions 1.1.1 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:1.1.2:*:*:*:*:*:*:* Versions 1.1.2 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:1.1.3:*:*:*:*:*:*:* Versions 1.1.3 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:1.1.4:*:*:*:*:*:*:* Versions 1.1.4 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:1.1.5:*:*:*:*:*:*:* Versions 1.1.5 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:1.9.84:*:*:*:*:*:*:* Versions 1.9.84 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:1.9.87:*:*:*:*:*:*:* Versions 1.9.87 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:1.9.91:*:*:*:*:*:*:* Versions 1.9.91 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:1.9.93:*:*:*:*:*:*:* Versions 1.9.93 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:1.9.95:*:*:*:*:*:*:* Versions 1.9.95 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:1.9.100:*:*:*:*:*:*:* Versions 1.9.100 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:1.9.104:*:*:*:*:*:*:* Versions 1.9.104 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:1.9.113:*:*:*:*:*:*:* Versions 1.9.113 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:1.9.118:*:*:*:*:*:*:* Versions 1.9.118 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:1.9.122:*:*:*:*:*:*:* Versions 1.9.122 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:1.9.130:*:*:*:*:*:*:* Versions 1.9.130 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:1.9.156:*:*:*:*:*:*:* Versions 1.9.156 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:1.9.680:*:*:*:*:*:*:* Versions 1.9.680 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:2.0:beta2:*:*:*:*:*:* Versions 2.0 beta2 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:2.0.2:*:*:*:*:*:*:* Versions 2.0.2 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:2.0.2:rc1:*:*:*:*:*:* Versions 2.0.2 rc1 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:2.0.2:rc2:*:*:*:*:*:* Versions 2.0.2 rc2 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:2.0.3:*:*:*:*:*:*:* Versions 2.0.3 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:2.0.4:*:*:*:*:*:*:* Versions 2.0.4 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:2.1.152:*:*:*:*:*:*:* Versions 2.1.152 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:2.1.154:*:*:*:*:*:*:* Versions 2.1.154 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:2.2:*:*:*:*:*:*:* Versions 2.2 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:2.3:*:*:*:*:*:*:* Versions 2.3 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:2.3.1:*:*:*:*:*:*:* Versions 2.3.1 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:2.4:*:*:*:*:*:*:* Versions 2.4 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:2.4.1:*:*:*:*:*:*:* Versions 2.4.1 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:2.4.1:*:64-bit:*:*:*:*:* Versions 2.4.1 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:3.01:*:*:*:*:*:*:* Versions 3.01 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:605b:*:*:*:*:*:*:* Versions 605b Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:609:*:*:*:*:*:*:* Versions 609 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:614:*:*:*:*:*:*:* Versions 614 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:619:*:*:*:*:*:*:* Versions 619 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:627:*:*:*:*:*:*:* Versions 627 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:633:*:*:*:*:*:*:* Versions 633 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:638:*:*:*:*:*:*:* Versions 638 Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:638c:*:*:*:*:*:*:* Versions 638c Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:641b:*:*:*:*:*:*:* Versions 641b Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:641d:*:*:*:*:*:*:* Versions 641d Vulnerable ·Openoffice
  • cpe:2.3:a:openoffice:openoffice.org:643:*:*:*:*:*:*:* Versions 643 Vulnerable ·Openoffice

Remediation

Red Hat 1 advisory

  • RHSA-2009:1426 Released 2009-09-04 · Red Hat rating Important
    openoffice.org security update
    • Red Hat Desktop version 3 openoffice.org-1.1.2-44.2.0.EL3, openoffice.org-1.1.2-44.2.0.EL3.i386, openoffice.org-i18n-1.1.2-44.2.0.EL3.i386 +1
    • Red Hat Enterprise Linux AS version 3 openoffice.org-1.1.2-44.2.0.EL3, openoffice.org-1.1.2-44.2.0.EL3.i386, openoffice.org-i18n-1.1.2-44.2.0.EL3.i386 +1
    • Red Hat Enterprise Linux AS version 4 openoffice.org-1.1.5-10.6.0.7.EL4.1, openoffice.org-1.1.5-10.6.0.7.EL4.1.i386, openoffice.org-1.1.5-10.6.0.7.EL4.1.ppc +47
    • Red Hat Enterprise Linux Desktop (v. 5 client) openoffice.org-1:2.3.0-6.11.el5_4.1, openoffice.org-base-1:2.3.0-6.11.el5_4.1, openoffice.org-base-1:2.3.0-6.11.el5_4.1.i386 +47
    • Red Hat Enterprise Linux Desktop Workstation (v. 5 client) openoffice.org-1:2.3.0-6.11.el5_4.1, openoffice.org-sdk-1:2.3.0-6.11.el5_4.1, openoffice.org-sdk-1:2.3.0-6.11.el5_4.1.i386 +2
    • Red Hat Enterprise Linux Desktop version 4 openoffice.org-1.1.5-10.6.0.7.EL4.1, openoffice.org-1.1.5-10.6.0.7.EL4.1.i386, openoffice.org-i18n-1.1.5-10.6.0.7.EL4.1.i386 +47
    • Red Hat Enterprise Linux ES version 3 openoffice.org-1.1.2-44.2.0.EL3, openoffice.org-1.1.2-44.2.0.EL3.i386, openoffice.org-i18n-1.1.2-44.2.0.EL3.i386 +1
    • Red Hat Enterprise Linux ES version 4 openoffice.org-1.1.5-10.6.0.7.EL4.1, openoffice.org-1.1.5-10.6.0.7.EL4.1.i386, openoffice.org-i18n-1.1.5-10.6.0.7.EL4.1.i386 +47
    • Red Hat Enterprise Linux Optional Productivity Applications (v. 5 server) openoffice.org-1:2.3.0-6.11.el5_4.1, openoffice.org-base-1:2.3.0-6.11.el5_4.1, openoffice.org-base-1:2.3.0-6.11.el5_4.1.i386 +47
    • Red Hat Enterprise Linux WS version 3 openoffice.org-1.1.2-44.2.0.EL3, openoffice.org-1.1.2-44.2.0.EL3.i386, openoffice.org-i18n-1.1.2-44.2.0.EL3.i386 +1
    • Red Hat Enterprise Linux WS version 4 openoffice.org-1.1.5-10.6.0.7.EL4.1, openoffice.org-1.1.5-10.6.0.7.EL4.1.i386, openoffice.org-i18n-1.1.5-10.6.0.7.EL4.1.i386 +47

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Desktop version 3Fixed RHSA-2009:1426
Red Hat Enterprise Linux AS version 3Fixed RHSA-2009:1426
Red Hat Enterprise Linux AS version 4Fixed RHSA-2009:1426
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2009:1426
Red Hat Enterprise Linux Desktop Workstation (v. 5 client)Fixed RHSA-2009:1426
Red Hat Enterprise Linux Desktop version 4Fixed RHSA-2009:1426
Red Hat Enterprise Linux ES version 3Fixed RHSA-2009:1426
Red Hat Enterprise Linux ES version 4Fixed RHSA-2009:1426
Red Hat Enterprise Linux Optional Productivity Applications (v. 5 server)Fixed RHSA-2009:1426
Red Hat Enterprise Linux WS version 3Fixed RHSA-2009:1426
Red Hat Enterprise Linux WS version 4Fixed RHSA-2009:1426

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-0200
  2. 2026-10-03 Alias added: GHSA-vqgr-rw7q-xxwm

References

Advisory 9

Other 3

  • TI-2008-00297 Heap-based buffer overflow in the OLE importer in OpenOffice.org before 2.4 allows remote… CVSS 2.0HIGH 9.3
  • TI-2010-02809 Integer overflow in simpress.bin in the Impress module in OpenOffice.org (OOo) 2.x and… CVSS 2.0HIGH 9.3
  • TI-2010-02808 simpress.bin in the Impress module in OpenOffice.org (OOo) 2.x and 3.x before 3.3 does… CVSS 2.0HIGH 9.3
  • TI-2009-00242 The Word processor in OpenOffice.org 1.1.2 through 1.1.5 allows remote attackers to cause… CVSS 2.0HIGH 9.3
  • TI-2009-00188 Heap-based buffer overflow in OpenOffice.org (OOo) before 3.1.1 and StarOffice/StarSuite… CVSS 2.0HIGH 9.3
  • TI-2008-02149 Multiple integer overflows in OpenOffice.org (OOo) 2.x before 2.4.2 allow remote… CVSS 2.0HIGH 9.3
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences